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WHAT IS CLAIMED IS : 

1 . A method for linguistic analysis comprising: 

receiving a user selection from a list of pre-defined categories; 
preparing data; and 

scoring the data based on the user-selected category to produce a tally, 
preparing the data including: 

collecting the data from at least one of a data stream, a file system, and a 

database; and 

partitioning the data. 

2. The method of claim 1, further comprising receiving a custom category 
definition from the user, scoring the data further based on the custom category 
definition. 

3. The method of claim 2, wherein the custom category is dependent upon the 
user-selected category. 

4. The method of claim 1, further comprising 

determining whether the user-selected category is a hit based on the tally; and 
performing at least one predetermined action where it is determined that the 
user-selected category is a hit. 

5. The method of claim 4, wherein determining is based on at least one of 
threshold scoring and Boolean logic scoring. 

6. The method of claim 4, wherein the predetermined action is at least one of 
blocking access, alerting an administrator, and logging data. 

7. A method for linguistic analysis comprising defining complex aggregate 
behavior with a plurality of triggers in a hierarchical relationship. 
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8. The method of claim 7, wherein defining complex aggregate behavior includes 
associating a score with each of the plurality of triggers. 

9. The method of claim 8, wherein defining complex aggregate behavior further 
includes applying at least one of an addition operator, a subtraction operator, a 
multiplication operator and a division operator to the score associated with at least one 
of the plurality of triggers. 

10. The method of claim 8, wherein defining complex aggregate behavior further 
includes applying a negation operator to the score of at least one of the plurality of 
triggers. 

1 1 . The method of claim 7, wherein defining complex aggregate behavior includes 
associating a pattern tuple with at least one of the plurality of triggers. 

12. The method of claim 11, further comprising simplifying the complex aggregate 
behavior by combining two or more triggers having the same associated pattern tuple. 

13. The method of claim 7, wherein defining complex aggregate behavior includes 
associating a list of pre-requisite triggers, scores for each of the pre-requisite triggers, 
and negation status with at least one of the plurality of triggers. 

14. The method of claim 13, further comprising simplifying the complex aggregate 
behavior by combining two or more triggers having the same associated list of pre- 
requisite triggers, scores for each of the pre-requisite triggers, and negation status. 

15. The method of claim 7, wherein defining complex aggregate behavior includes 
associating at least one of a plurality of actions with at least one of the plurality of 
triggers. 
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16. The method of claim 15, further comprising simplifying the complex aggregate 
behavior by not resolving any of the plurality of triggers that are not associated with at 
least one of the plurality of actions. 

1 7. A method for linguistic analysis comprising: 
receiving data; 

setting a tally for a containing trigger equal to zero; 

ordering a plurality of pre-requisite triggers based on decreasing absolute value 
of a score associated with each of the plurality of pre-requisite triggers; and 

selecting one of the plurality of pre-requisite triggers based on the order. 

1 8. The method of claim 1 7, further comprising: 

determining whether the selected one of the plurality of triggers is a hit; 

if the selected one of the plurality of triggers is a hit, updating the tally by 
adding to the tally the score associated with the selected one of the plurality of triggers; 

determining whether the updated tally less the sum of absolute values of scores 
associated with each unresolved trigger within the plurality of pre-requisite triggers is 
greater than a predetermined threshold; and 

if the updated tally less the sum of absolute values of scores associated with 
each unresolved trigger within the plurality of pre-requisite triggers is greater than the 
predetermined threshold, resolving the containing trigger as a hit 

1 9. The method of claim 1 8, further comprising: 

if the updated tally less the sum of absolute values of scores associated with 
each unresolved trigger within the plurality of pre-requisite triggers is not greater than 
the predetermined threshold, determining whether each of the pre-requisite triggers 
have been selected; and 

if each of the pre-requisite triggers have been selected, resolving the containing 
trigger as a non-hit. 
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20. A method for linguistic analysis comprising: 

defining a category having a first pre-requisite trigger and a second pre-requisite 

trigger; 

receiving a first data set; 

determining whether the first pre-requisite trigger is a hit based on the first data 

set; 

if the first pre-requisite trigger is a hit, determining whether a score of the first 
pre-requisite trigger is greater than zero; 

if the score of the first pre-requisite trigger is greater than zero, determining 
whether the second pre-requisite trigger is a hit based on the first data set; 

if the second pre-requisite trigger is a hit, determining whether a score of the 
second pre-requisite trigger is greater than zero; and 

if the score of the second pre-requisite trigger is greater than zero, resolving the 
category as a hit with respect to the first data set. 

2 1 . The method of claim 20, further comprising: 

if the first pre-requisite trigger is a hit, increasing an Avoid Evaluation Of This 
Trigger (AEOTT) rating associated with the first pre-requisite trigger. 

22. The method of claim 2 1 , further comprising: 
receiving a second data set; 

determining whether the second pre-requisite trigger is a hit based on the second 
data set; 

if the second pre-requisite trigger is a hit, determining whether a score of the 
second pre-requisite trigger is greater than zero; 

if the score of the second pre-requisite trigger is greater than zero, determining 
whether the first pre-requisite trigger is a hit based on the second data set; 

if the first pre-requisite trigger is a hit, determining whether a score of the first 
pre-requisite trigger is greater than zero; and 

if the score of the first pre-requisite trigger is greater than zero, resolving the 
category as a hit with respect to the second data set. 
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23. A method for linguistic analysis comprising: 

defining a category having a first pre-requisite trigger and a second pre-requisite 

trigger; 

receiving a first data set; 

determining whether the first pre-requisite trigger is a hit based on the first data 

set; 

if the first pre-requisite trigger is a hit, determining whether a score of the first 
pre-requisite trigger is greater than zero; 

if the score of the first pre-requisite trigger is greater than zero, resolving the 
category as a hit with respect to the first data set. 

if the first pre-requisite trigger is not a hit, determining whether the second pre- 
requisite trigger is a hit based on the first data set; 

if the second pre-requisite trigger is a hit, determining whether a score of the 
second pre-requisite trigger is greater than zero; and 

if the score of the second pre-requisite trigger is greater than zero, resolving the 
category as a hit with respect to the first data set. 

24. The method of claim 23, further comprising: 

if the first pre-requisite trigger is a hit, decreasing an Avoid Evaluation Of This 
Trigger (AEOTT) rating associated with the first pre-requisite trigger. 

25. A method for linguistic analysis comprising: 

initializing a Avoid Evaluation Of This Trigger (AEOTT) rating for a pre- 
requisite trigger; 

resolving the pre-requisite trigger based on a first data set; 

determining whether resolving the pre-requisite trigger caused an early exit; 

if resolving the pre-requisite trigger caused an early exit, decreasing the AEOTT 
rating; and 

if resolving the pre-requisite trigger did not cause an early exit, increasing the 
AEOTT rating. 
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26. A machine-readable medium having instructions stored thereon for execution 
by a processor, the instructions configured to perform a method comprising: 

receiving a user selection from a list of pre-defined categories; 
preparing data; and 

scoring the data based on the user-selected category to produce a tally, 
preparing the data including: 

collecting the data from at least one of a data stream, a file system, and a 

database; and 

partitioning the data. 

27. A machine-readable medium having instructions stored thereon for execution 
by a processor, the instructions configured to perform a method comprising defining 
complex aggregate behavior with a plurality of triggers in a hierarchical relationship. 

28. A machine-readable medium having instructions stored thereon for execution 
by a processor, the instructions configured to perform a method comprising: 

receiving data; 

setting a tally for a containing trigger equal to zero; 

ordering a plurality of pre-requisite triggers based on decreasing absolute value 
of a score associated with each of the plurality of pre-requisite triggers; and 

selecting one of the plurality of pre-requisite triggers based on the order. 

29. A machine-readable medium having instructions stored thereon for execution 
by a processor, the instructions configured to perform a method comprising 
dynamically re-ordering a plurality of pre-requisite triggers, re-ordering based on a 
likelihood in each of the plurality of pre-requisite triggers to cause an early exit during 
resolution of a category containing the plurality of pre-requisite triggers. 
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